CVE-2026-87202 is a vulnerability in Oracle Hyperion Financial Management (component: Security) version 11.2.26.0.000. It permits a low-privileged attacker with network access to exploit SQL-based attack vectors to compromise the system, potentially resulting in full takeover. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle's September 2026 Critical Security Patch Update includes fixes for this vulnerability among 673 others across various Oracle products.

Successful exploitation of this vulnerability can lead to complete compromise of Oracle Hyperion Financial Management, affecting confidentiality, integrity, and availability of the system. This could allow attackers to gain unauthorized control over the application and its data.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability. Customers are strongly advised to apply the available security patches promptly and remain on actively supported versions. Oracle emphasizes that failure to apply patches has led to successful exploitation attempts in the past. No indication of alternative mitigations or temporary fixes is provided; patching is the recommended remediation.